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design code: summary of responses 


Introduction 


In June 2018, the ICO issued a call for views on the Age Appropriate 
Design Code (‘the Code’). Overall, we received 97 responses from a 
variety of stakeholders. Responses from organisations are available to 
read on our website. 


The call for views is one strand of the ICO’s consultation, with research 
also commissioned to understand the views of children and their parents. 
This research has now been completed and the resultant report Towards a 


better digital future - informing the Age Appropriate Design Code has 
been published on our website. 


This summary of responses has now been updated with the ICO’s 
responses to the key themes that were raised. 


Key themes 


A wide variety of general and detailed issues were raised. Whilst it is not 
possible to cover every point that was raised in detail, a number of key 
themes emerged which are summarised below. 


Age brackets and evidence 


Many respondents felt that the suggested age brackets were appropriate 
or very appropriate, with some suggestions of how these could be 
improved or amended (eg to reflect key stages in education). 


Some respondents, particularly those representing the views of ISS, felt 
that the age brackets were not really or at all appropriate. Some of the 
reasons given include that they would require collection of more personal 
data and the implementation of age verification procedures. Concerns 
were raised about how this would fit in with data minimisation standards. 
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Potential difficulties in obtaining and verifying parental consent for 
children under 13 were also raised. 


Concerns were also expressed that age brackets will be difficult to 
implement into online services, resulting in the withdrawal of products or 
a lack of child access to certain services. Some respondents also noted 
that use of age brackets may result in five different versions of the Code, 
making it difficult to comply with and administer. 


A key theme that emerged, however, was that design standards shouldn’t 
be based solely on age, as ISS providers need to take into account that 
children develop differently at different rates and don’t fit neatly into 
different age groups. Accordingly, it was felt important to consider other 
factors, such as children’s cognition, social and emotional development, 
disabilities and special educational needs, mental age, etc. In addition, 
many respondents noted that more vulnerable children will require 
additional protections. 


Finally, the importance of the role of parents/carers was noted. 
Particularly, it was suggested that parents/carers are best placed to judge 
the child’s competency. Similarly, it was expressed that parental/carer 
involvement would be beneficial to children’s privacy as they could assist 
the child in adjusting settings or considering privacy information. It was, 
however, noted that not all parents/carers are digitally literate or 
understand the implications of the use of a service on a child’s privacy. 


ICO Response 


Our draft of the Code for public consultation has regard to the fact that 
children have different needs at different ages (as required by s123 of 
the DPA 2018) by including some content specific to the age ranges that 
we consulted upon in our call for evidence. However we have sought to 
recognise that that age ranges are not a perfect guide to the interests, 
needs and evolving capacities of each individual child by presenting this 
content as guidelines to inform a general approach, rather than as 
prescriptive requirements. There will be one version of the Code which 
requires some tailoring of service to age range. 


We have sought to recognise the challenges and privacy implications of 
requiring ISS providers to put robust age verification mechanisms in 
place to establish which of their users are adults, which are children and 
how old those children are, in order to provide an age appropriate 
service. We have therefore taken the approach that ISS providers 
whose services are likely to be accessed by children should provide a 
default service which is suitable for use by all users regardless of their 
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age. With this as the (child-friendly) default position ISS providers can 
then rely upon self-declaration of age to inform their communications 
with users and to tailor other aspects of their online service to the age 
range of the user (be they child or adult), putting additional mitigating 
measures in place depending upon their assessment of risks. If they 
wish to they can also offer users the option of proving their age via a 
robust age verification mechanism instead, with the result that, for 
those users who can prove they are adults, the provisions of the code 
would not have to apply. We hope this provides a balanced and 
proportionate approach to a challenging issue, providing appropriate 
protections for children whilst recognising the privacy rights of all users 
including adults. 


We have sought to recognise the importance of the role of parents and 
carers by including various provisions which will mean that ISS 
providers need to prompt and support age appropriate parental 
involvement in children’s use of online services and connected devices, 
whilst also taking their own responsibility for providing an age 
appropriate service and respecting the child’s evolving capacity to make 
their own decisions. 


The United Nations Convention on the Rights of the Child 


Most respondents were positive about applying the Convention to the 
provisions of the Code, with many suggestions about how the Convention 
may apply in this context. 


Most prominently, it was expressed that ISS should act and design 
services ‘in the best interests’ of the child, putting the child’s best 
interests above the commercial interests of the ISS. 


Several respondents commented that although Article 16 - the right to 
privacy — is perhaps the most relevant to the Code, it is still important to 
take into account the other rights in the convention, and to ensure any 
focus on privacy is balanced with them - eg right to information and 
protection from harmful information, right to be heard, etc. The 
implication of this being that overly prescriptive standards and privacy 
settings could affect a child’s other rights under the convention. 


Some noted the Convention's recognition of a child’s evolving capacity, 
which could be relevant to the design of ISS at different age brackets. 


ICO response 
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Our draft of the Code for public consultation has regard to the United 
Kingdom’s obligations under the United Nations Convention on the 
Rights of the Child by incorporating the key principle from the 
convention of ‘the best interests of the child’ as a specific standard of 
age appropriate design and also as a theme that runs throughout the 
provisions of the Code. It recognises that the best interests of the child 
are a primary (but not the only) consideration under the Convention 
and that it provides a framework which balances a number of different 
interests and concerns. Our draft accounts for other convention rights 
such as the rights to privacy, access to information, the child’s evolving 
Capacity to have their views accounted for, and the role of parents in 
acting in the best interests of the child. 


Aspects of design (meaning, coverage, where the bar should be 
set and challenges) 


Default privacy settings 


Most respondents felt that default privacy settings should be high and set 
to collect the least data possible. It was also expressed that it should be 
very clear to children where they should go to alter their privacy settings. 
There were conflicting views on whether privacy settings should revert to 
default once the child has navigated away from the page. Whilst some 
believed this was a credible option, others felt that this was taking control 
away from the user. It was also expressed that reverting to default 
settings every time results in a poor user experience. 


Another theme that emerged was that if service or software is updated, 
the default settings should not be altered to be less restrictive. Others 
commented that there may be an appetite for standardised privacy 
settings, allowing children to easily recognise where to locate and how to 
adjust settings. 


Finally, a number of respondents noted that high privacy settings 
shouldn't unnecessarily restrict or block children from using a service. 
Neither should the design of the service encourage children to lower their 
privacy settings when it wouldn't be in their best interests. 


ICO response 


Our draft of the Code for public consultation includes a standard on 
providing high privacy settings by default, recognising the high level of 
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support for this proposal which also came through clearly in our 
consultation with children, parents and carers. We have sought to 
respect issues of user choice and impact on user experience by saying 
that ISS providers should give users a choice between retaining any 
changes they may have made to the default settings or reverting back 
to the high privacy defaults, and by providing that software options 
should respect existing user choices whenever possible. 


- Data minimisation standards 


There was a consensus amongst respondents that an ISS should only 
collect and process the minimum personal data necessary for the 
operation of the service, particularly where collecting children’s personal 
data. In addition, respondents felt that the ISS must show reasonable 
justification for the collection and processing of all personal data. 


Other suggestions made by respondents include higher data minimisation 
standards for the youngest users; for processing of personal data to cease 
as soon as the child exits the service; and that personal data should be 
deleted when the child has finished using the service. Linked to this, it 
was suggested that there should be expiry standards, data caps and time 
limits and that children should be given frequent opportunities to delete 
their personal data. 


Several respondents raised concerns about the effect on data 
minimisation if the proposed age brackets were implemented. It was felt 
that age brackets may require the implementation of age verification and 
parental consent mechanisms, resulting in ISS collected more personal 
data to verify the child’s age and/or parental consent. 


ICO response 


Our draft of the Code for public consultation seeks to provide clarity 
about what data minimisation means in the context of online services. 
ISS providers will need to differentiate between different elements of 
their services, allow children choice over whether to activate elements 
of service, be clear about what data is needed to provide each individual 
element and not collect any more data than is really needed to do so. 


The issue about collection of data for age verification purposes is 
addressed under the earlier heading age brackets and evidence. 
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Presentation and language of terms and conditions and privacy 
notices 


Respondents considered that this aspect should cover the wording, 
phrasing, length, format, etc of terms and conditions and privacy notices. 
Respondents noted the challenges of providing privacy information and 
ensuring that it is read and properly understood by young children. Many 
highlighted research/studies which show that many people do not read 
privacy information. One respondent felt there is too much emphasis on 
privacy information as it relied upon the child being capable of reading 
them (or having a parent/carer who is). 


The prominent theme was that the presentation and language of terms 
and conditions and privacy notices need to be appropriate for the age of 
the user. This included using plain, simple and concise language and 
presenting it in an accessible way. It was suggested that ISS should be 
encouraged to use child-friendly methods such as audio and video, as well 
as using images and bigger font sizes. 


As with default privacy settings, some respondents felt that children 
should not be restricted from using a service if they refused to accept the 
terms and conditions. It was noted by some that terms and conditions 
form part of legally enforceable agreements and cannot be oversimplified 
or else they will lose meaning. 


Finally, some respondents expressed concern that the code should not 
prescribe specific methods or limit the way privacy information is 
provided. It was argued that a requirement to use certain methods may 
be too costly for smaller organisations, meaning they cannot operate in 
the market. Similarly, restricting the way privacy information is provided 
may prevent organisations from going above and beyond to provide 
information in new and innovative ways. 


ICO response 


Our draft of the Code for public consultation seeks to address the point 
that many children do not currently read privacy information or terms 
and conditions by making the transparency standard only one standard, 
which sits alongside other standards which do not rely upon children or 
their parents or carers engaging with such information. 
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We provide guidelines on communicating with children within different 
age ranges, without being prescriptive and address the point about the 
purpose of terms and conditions and the risks of oversimplifying th 


Uses of geolocation technology 


Respondents suggested that this should cover any information including 
location, time, duration and traffic information relating to an individual’s 
use of a device. It was suggested that the definition of geolocation be 
clearly set out in the Code to avoid limiting tracking, for example, for 
anti-fraud purposes. 


The majority of respondents felt that geolocation should be turned off by 
default unless critical to the service offered. Again, it was suggested that 
this default should not revert after a software update, etc. In addition, 
there was support for the idea that geolocation data should only be used 
whilst the app/service is in use and there should be a clear indicator to 
remind the user this data is being processed. Furthermore, it was felt that 
the user experience should not be downgraded for children who chose not 
to allow location tracking. 


Others considered that geolocation should not be offered to children 
under a certain age, although there were differing views on where this 
age should be set. 


ICO response 


Our draft of the Code for public consultation provides that geo-location 
services should be turned off by default and, for services which make 
the child’s location visible to others, after each use. 


Automated and semi-automated profiling 


It was suggested that profiling should be clearly defined within the Code, 
including distinguishing between ‘good’ and ‘bad’ profiling. 

Some respondents believed that auttomated/semi-automated profiling is 
inappropriate for children and therefore should not take place, unless it 
can be demonstrated to be in child's best interest. 


Some felt that a Data Protection Impact Assessment (DPIA) should be a 
prerequisite before any profiling of children takes place. It was also 
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important to some respondents that children (or their parents/carers) 
were able to understand the basis of the profiling before it takes place, 
express a view on the results and contest the accuracy. 


ICO response 


Our draft of the Code for public consultation addresses the different 
ways in which profiling can be used in an online context. It provides 
that any settings or features based on the profiling of children should be 
switched off by default but stops short of prohibiting the profiling of 
children. This recognises the European Data Protection Board opinion 
that profiling of children is not prohibited and also the results of the 
consultation with children and parents and carers who had mixed views 
about the pros and cons of profiling but wanted to retain some user 
choice. We sought to respect parental choice and the rights of the child 
to have their views taken into account in line with their evolving 
capacity by allowing children or parents to choose to activate profiling 
options, whilst mitigating risks via standards on transparency and 
nudge techniques. We also sought to avoid unintended consequences of 
restricting user choice by prohibiting profiling (such as increasing 
incentives to lie about age and thereby losing the protection of age 
appropriate measures). 


We provide that ISS providers who provide online services likely to be 
accessed by children will in any case (even if no profiling) always need 
to do a DPIA. 


Transparency of paid-for activity such as product placement and 
marketing 


Respondents tended to agree in this area that paid for activity should be 
overt and transparent so it should be clear to children. There was strong 
feeling that children’s data should not be used for commercial 
purposes/exploitation, or processed for behavioural advertising. 


It was suggested that this area may be challenging for the Code to cover 
as it crosses into the remit of the Advertising Standards Authority. 


ICO response 


Our draft of the Code for public consultation provides that ISS providers 
should not use children’s personal data in ways that run counter to 
industry standards, such as the Committee for Advertising Practice 
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(CAP) code, which covers the transparency of paid for activity and 
product placement. This recognises the results of the consultation with 
parents and carers whose preferred solution to this issue was to ensure 
that advertising content meets industry guidelines for advertising 
directed at children. 


Sharing and resale of data 


It was noted that the Code should define and distinguish between these 
two areas. ‘Sharing’ was taken to cover both internal sharing and sharing 
with external third parties. 


Generally, it was felt that the sharing/sale of children’s personal data 
should be strictly controlled or limited. Any sharing should be transparent, 
with the ability to track who the data has been shared to. Where consent 
is given to share data, it was expressed that this should not be considered 
unlimited by the ISS. 


Linked with the default privacy settings, it was suggested that ISS should 
not automatically opt children in to sharing of their data by default, nor 
should opting in be a condition of the service. The concern for many was 
that commercial interests should not override what is in the best interests 
of the child. 


In contrast to the standards ISS should adhere to when deciding whether 
to share children’s personal data, some respondents also considered the 
ability of children themselves to share their personal data. This links in 
with privacy settings, in that younger children perhaps should be more 
restricted in what they can share, with a greater element of control to 
share as they get older, with warnings or messages about the potential 
risks/consequences of sharing given by the ISS at the point they wish to 
change settings to enable sharing, or when posting content. 


ICO response 


Our draft of the Code for public consultation provides that data sharing 
options should be switched off by default. We have addressed issues of 
transparency, and of best interests of the child when selling personal 
data for commercial gain. 
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We have addressed issues about children’s own sharing of their 
personal data in the section of the Code on privacy settings 


O Strategies used to encourage extended user engagement 


The main themes arising from respondents was that this practice should 
be limited, made appropriate to the age of the child, and clearly 
identified. Respondents suggested it should cover features designed to 
extend user engagement (so-called ‘sticky’ features’), and factors such as 
wording used by ISS, forced actions, the ease of changing privacy and 
other settings, rewarding children for using a service, as well as 
notifications, autoplay and infinite scroll features. 


Much of the concern was around the negative aspects of compulsive or 
persuasive design, leading children to spend more time online and 
consequently to provide more personal data. A particular issue noted was 
that many children struggle to manage their time online and are more 
susceptible to these features. Some respondents thought that strategies 
to encourage extended user engagement should be clearly identified and 
rated, linking in with the suggestion of establishing a labelling or rating 
system for privacy. This would contribute to an ISS’s overall privacy 
rating, allowing users to make more informed decisions about using the 
service. 


Others thought that persuasive design features should be removed due to 
their perceived negative aspects, whereas others considered that 
implementing measures to mitigate against them may be more effective. 
For example, some respondents suggested that notifications about a 
child’s use/time spent on an ISS may be more effective than imposing 
time restrictions. They also wanted best practice guidance on persuasive 
design on children, including where extended use could be harmful, and 
where such designs can be acceptable and age-appropriate. 


Also, aS a counterpoint to banning persuasive design outright, one view 
was that ISS should be free to develop fun and engaging content, so long 
as this is transparent and within the law. 


ICO response 


Our draft of the Code for public consultation notes that there is no 
conclusive evidence in relation to the effect of strategies used to extend 
user engagement on the health and wellbeing of the child, but draws 
upon an opinion issued by the Chief Medical Officers of the UK which 
recommends a precautionary approach to this issue. We have therefore 
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said that, pending conclusive evidence, children’s personal data should 
not be used in strategies designed to extend user engagement. 


O User reporting and resolution processes and systems 


Most respondents agreed that the reporting and resolution processes for 
children should be easy to use and responsive to their needs. This may 
include adding reporting buttons to content/posts, or otherwise clearly 
signposting reporting mechanisms. In addition, including human support 
as part of the process, or allowing children to take their own action (such 
as ‘un-tagging’ pictures of themselves) was felt beneficial. 


It was also felt important to include the ability to track the progress of a 
complaint, and establishing a timescale to address it, with the ISS having 
to give reasons if it rejects or refuses to investigate a complaint, and 
having to signpost an appeal route or how the child can then exercise 
their rights. Some suggested that there should be a universal reporting 
standard, so the process is familiar to all children and therefore easier to 
exercise. 


One other suggestion was to introduce the grading of complaints by 
urgency, based on the child’s perspective. For smaller businesses, some 
felt it was important not to force costly solutions on businesses, in order 
to maintain a level playing field. 


It was noted that introducing specific processes for children to report 
concerns may create the additional challenge of requiring age verification 
procedures. 


ICO response 


The draft of the Code for public consultation addresses providing 
prominent and easily accessible age appropriate tools that are easy or 
children to use, and that allow for tracking of progress. It stops short of 
mandating standardised or universal tools, allowing ISS providers some 
discretion in this respect. We do not require the introduction of age 
verification mechanisms to support reporting of concerns by children. 


In the future certification schemes could be used to encourage some 
industry standardisation. 
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O Ability to understand and activate a child’s right to erasure, 
rectification and restriction 


Like with user reporting and resolution systems, respondents considered 
it would be beneficial for ISS to develop standardised tools to allow 
children to exercise their rights in a simple and straightforward manner. 
Again, making the process easily accessible and responsive is seen as 
key. Some consider that ISS should be compelled to incorporate the 
activation of rights into the design of their services. 


A presumption in favour of accepting a child’s request to exercise their 
rights was also promoted, although some felt this would undermine the 
legal requirements of the right and risk data being erased which is 
necessary. Particular focus was made by some respondents on the 
importance of the right to erasure - this was in the context of issues 
around so-called ‘sharenting’ or where children are the victims of bullying 
and sexual exploitation, and the general concern about children posting 
information when they may not fully realise the consequences. 


A number of respondents advocated the implementation by government 
of Article 80(2) of the GDPR, feeling this would increase protection by 
allowing other bodies to be proactive pursue matters on behalf of 
children. 


Another respondent made the point that the principles of 
activating/exercising rights should be consistent to both adults and 
children and that business should be allowed to work out best way to 
deliver information about exercising rights. 


ICO response 


Our draft of the Code for public consultation addresses these 
suggestions without being prescriptive about the exact nature of the 
tools that should be provided. It stops short of mandating standardised 
or universal tools. 


We do not address the implementation of Article 80(2) as this is a 
matter for Government and outside the remit of the Code. However we 
are clear about our intention to enforce in relevant cases. 


O Ability to access advice from independent, specialist advocates on all 
data rights 
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As a continuation of the general theme of making processes and systems 
easy for children to use, respondents were in favour of ISS enabling 
children to access help and advice and making the process easy and 
responsive. 


General themes and comments 


A point that was raised by a number of respondents was the importance 
of including the input of children themselves into the process of 
developing design standards and the design of ISS. 


A number of respondents wanted clarification/explanation of any terms 
used in the code and to make them as plain English as possible 


Another theme that came out of the submissions was that changing or 
setting the standards of design as detailed above would shift the 
responsibility for ensuring the privacy of children from the children 
themselves and their parents, to ISS, where children can’t be expected to 
bear the burden of ensuring their own privacy, which can be a complex 
area. 


ICO response 


Our draft of the Code for public consultation addresses these points and 
makes it clear that ISS providers have to take their own responsibility 
for providing age appropriate services. We have also included an 
accountability standard to ensure that ISS providers demonstrate that 
they have done so. 


A theme by some respondents was the introduction of a traffic light or 
labelling systems for different aspects of design of ISS, in order to make 
it easier for children and their parents to determine the privacy standards 
of any given ISS. 


ICO response 


Our draft of the Code for public consultation acknowledges the part that 
such a certification scheme might play in supporting children and 
parents in making positive choices about which online services to use, 
and ISS providers in demonstrating their compliance with the Code. It 
does not introduce a scheme as this would go beyond the remit of the 
Code, and encourages the development of schemes by industry. 
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Again, the idea that children’s ‘best interests’ should be the focus in all 
aspects of design was a common theme. Similarly, making ISS be 
required to carry out a ‘childhood’ DPIA to cover the different aspects of 
design was recommended. 


ICO response 


Our draft of the Code for public consultation includes standards that 
address the best interests of the child and DPIAs. 


Noting the overlap with other industry standards and indeed other pieces 
of data protection guidance, a number of respondents wanted to see 
various other codes and guidance incorporated into the Code to place 
them on a ‘statutory footing’. 


ICO response 


We have not incorporated this suggestion as we felt it raised practical 
challenges, given that the content of other codes is outside of our 
control and may be subject to change (which would require updates to 
the Code via the Parliamentary process). Instead we have emphasised 
that ISS providers need to keep up to date with relevant industry 
standards and have cross referenced some of the most relevant. We 
have also said that ISS providers need to embed privacy management 
frameworks as part of their wider accountability measures. 


Many respondents were supportive of the proposals of 5Rights in response 
to the call for evidence, or at least elements of its submission. 


A number of respondents noted that to be successful, the Code would 
need to be influential internationally, given that not all ISS will be UK 
based. 


Additional standards 
Some respondents suggested age verification itself should be subject to a 
design standard. They also considered ISS should be required to carry out 


DPIAs focussed on children’s interests and issues as standard. Indeed, 
some extended this to including children in any design process. 
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Certification of ISS was also suggested by some. 


One respondent in particular considered that there should be an 


overarching duty of care employed by ISS that they be held to. Linked to 
this could be the incorporation of the precautionary principle, which it was 
felt would be a more suitable approach to setting standards given the fast 


pace of technological change. 


ICO response 


We have not gone so far as including these additional standards. Age 
verification is an area in which we have given some guidance but we 
would seek to support marketplace innovation, including through our 
regulatory sandbox, as industry develops privacy friendly solutions to 
this challenging area. 


Certification is an area that we would like to see developed but we 
consider it to be beyond the remit of this Code. 


An overarching duty of care is one area that has been suggested for 


has contributed to. 


consideration by Government in their Online Harms work, which the ICO 


Challenges and opportunities 


Challenges: 


Many respondents felt that age verification and obtaining parental 
consent would be a significant challenge. Either process would 
require the collection of more personal data and may be bypassed. 
Getting ISS to implement design by age brackets would require a 
redesign of existing services which, alongside developing multiple 
versions of new platforms, could be costly. 

Respondents felt that it would be a challenge to use existing child 
development evidence to make design standards appropriate for 
each age group. They noted the difficulty in ensuring they do not 
hinder children’s development online and allow them to evolve as 
individuals. 

The international nature of ISS was noted as an additional challenge 
particularly as the Code will be developed from UK law. There were 
more general concerns about monitoring compliance. 

There was concern that if the Code was too prescriptive, it could be 
costly (by forcing particular solutions) and discourage innovation in 
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products (by restricting the collection of personal data, or by setting 
limits in what an ISS can and can’t do) and potentially disadvantage 
SMEs. 

e The fact that technology evolves so quickly was noted as a 
challenge, being too prescriptive or having specific technical 
standards could render the code outdated quickly. It was suggested 
that the Code would work better if it was principle based/flexible, 
allowing for the development of new technology. 

e There was a view that setting some of the standards (where to 
draw the line - or even if saying something must be done ina 
child’s ‘best interests’ - and what are the definitions) can be 
challenging. 


e Many respondents felt it can be a challenge providing privacy 
information to children (and to a lesser extent, to parents). 


ICO response 

Some of these challenges, such as age verification, multiple 
jurisdictions and the global nature of online services and cost 
implication remain and may be the subject of future work. Others have 
been addressed within the draft of the Code for public consultation. 


Opportunities: 


e An opportunity to reshape the online experience for children - 
protecting their privacy, changing expectations and norms. 

e Many respondents noted the opportunity to raise awareness of 
privacy issues with children and their parents/carers and to educate 
them. 


ICO response 


We agree that the Age Appropriate Design Code provides a major 
opportunity to bring about real and meaningful change in the practice of 
ISS providers and the experience of children online. We look forward 
reviewing the responses to the public consultation stage. 


Examples of good ISS design 


Most responses to this question provided either examples of ISS that 
respondents considered of a good design, or what they considered would 
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be good design (the latter mirroring in many instances the standards 
discussed above). Of the existing ISS, it’s notable that the vast majority 
of these were services already aimed specifically at children as their 
intended audience/user base. 
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